Expert-level CodeQL for static analysis, vulnerability detection, and security code scanning

Run OpenAI Codex CLI as an independent reviewer over the current branch, a specific commit, or uncommitted changes. Builds a focused instruction file from the real diff and returns a compact review summary.

Query local Codex session history with jq. Use when users explicitly ask to search Codex sessions, inspect prior Codex conversations, find previous user messages, locate tool calls, summarize past work by working directory, or query Codex rollout JSONL files.

Analyze customer cohorts. Use when: acquisition cohorts, retention curves, LTV by cohort, behavioral segmentation.

This skill should be used when the user asks to "open CoinGecko historical data", "show historical price on date X", "open coingecko historical page", or wants to view the CoinGecko historical-data page for a coin around a given date in their default browser.

Connect to a running ComfyUI instance, queue workflows, monitor execution, and retrieve results. Supports both online (REST API) and offline (JSON export) modes. Use when executing ComfyUI workflows or checking server status.

Security anti-pattern for OS Command Injection vulnerabilities (CWE-78). Use when generating or reviewing code that executes shell commands, runs system processes, or handles user input in command-line operations. Detects shell string concatenation and recommends argument arrays.

Guide to writing slash commands for Claude Code. Use when creating commands that set mode, constraints, or workflows invoked via /command-name.

Create git commits with AI-generated messages following best practices. Use when the user asks to commit changes, mentions "commit", wants to save work to git, or has made changes ready to be committed. Invokes /git-actions:commit command which analyzes changes, generates concise messages matching repo style, and handles staging/approval workflow.

Commit changes, push to remote, and create a pull request. Use for completing features or fixes ready for review.

Patterns for designing component hierarchies, composition, and reusable UI elements

Suggest and generate custom element compositions for a UI goal. Use when the user asks to "compose elements", "build a layout", "combine components", "create a page with", "what elements should I use for", or describes a UI they want to build using custom elements.

Build browser/desktop automation agents using Claude's Computer Use capability — screen-taking, clicking, typing. Covers the reference container, virtualization safety, task decomposition, and when to use computer-use vs API integration. Use this skill when building agents that operate GUIs (browsers, legacy apps), automating workflows without APIs, or QA/testing agents. Activate when: Claude computer use, browser automation, desktop agent, screen control, computer_20250124, click and type agent.

Enforces brevity and signal-over-noise in all outputs. Eliminates verbose explanations, filler phrases, and unnecessary elaboration. Triggers on: every response (governs output length and density when loaded).

Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.

Set up the Discord channel — save the bot token and review access policy. Use when the user pastes a Discord bot token, asks to configure Discord, asks "how do I set this up" or "who can reach me," or wants to check channel status.

Guides users through configuring Tauri capabilities for security and access control, covering capability files, permissions, per-window security boundaries, and platform-specific configurations.

Guides the user through configuring Tauri permissions, including the security permission system, allow and deny lists, plugin permissions, permission identifiers, scopes, and capability integration.

Set up an MCP connector. Use when: connecting Google Ads, Salesforce, Mailchimp, or any service to the plugin.

Stage N3. Deep structural analysis of skill against real usage. Verifies gaps, prunes cruft, measures baseline health. Produces structural audit that feeds REM. Front-loaded in early cycles.

Use when the user invokes $spec-kit:constitution or /spec-kit:constitution, or asks to generate or update a pragmatic solo-dev project constitution.

When the user wants to create, optimize, or audit contact page and forms. Also use when the user mentions "contact page," "contact form," "get in touch," "support form," "contact us," "reach us," "contact information," "support contact," or "inquiry form." For sitewide page planning, use website-structure.

Adapt content across platforms with tone/format shifting — blog to social, long to short, text to visual outline. Use when repurposing content for different channels, audiences, or formats.

Repurpose and atomize content across platforms and formats. Use when the user says "repurpose this", "turn this into", "convert blog to", "make a thread from", "content atomization", "repurpose content", "turn this article into social posts", or asks about adapting content from one format to another.

Expert in browser extension content scripts, DOM integration, and safe page augmentation across modern web apps.

Proactively identify information gaps in project context and generate actionable questions to surface missing requirements, unclear specifications, or documentation gaps

Use when compressing agent context, implementing conversation summarization, reducing token usage in long sessions, or asking about "context compression", "conversation history", "token optimization", "context limits", "summarization strategies"

Use when diagnosing agent failures, debugging lost-in-middle issues, understanding context poisoning, or asking about "context degradation", "lost in middle", "context poisoning", "attention patterns", "context clash", "agent performance drops"

Use when optimizing agent context, reducing token costs, implementing KV-cache optimization, or asking about "context optimization", "token reduction", "context limits", "observation masking", "context budgeting", "context partitioning"

Resume interrupted work from context. Use when continuing after session break, context limit, or interruption.

Create conventional commit messages following best conventions. Use when committing code changes, writing commit messages, or formatting git history. Follows conventional commits specification.

Psychology of conversion for sponsored content. Includes emotional triggers, social proof, scarcity, urgency, and persuasion principles for video marketing. Auto-activates when discussing conversions, emotional triggers, social proof, urgency, scarcity, persuasion, or why people buy. Use when optimizing scripts for conversion or understanding buyer psychology.

Guidelines for building production-ready Convex apps covering function organization, query patterns, validation, TypeScript usage, error handling, and the Zen of Convex design philosophy

Deploy applications to Coolify self-hosting platform. Use when deploying to Coolify, configuring build settings, setting environment variables, managing health checks, or performing rollbacks.

Internal support skill for agent-browser CLI workflows used by rust-learner, docs-researcher, and crate-researcher. Use only when browser automation is explicitly required.

Internal support skill for agent-browser CLI workflows used by rust-learner, docs-researcher, and crate-researcher. Use only when browser automation is explicitly required.

Futuristic sci-fi aesthetic with dark themes, vibrant neon accents, and immersive spatial elements.

Sampling strategies for logs and traces to optimize costs while maintaining observability. PROACTIVELY activate for: (1) Configuring trace sampling, (2) Log volume reduction, (3) Head-based vs tail-based sampling, (4) Priority-based sampling, (5) Cost optimization. Triggers: "sampling", "trace sampling", "log sampling", "cost optimization", "head-based", "tail-based", "sample rate"

Defines ROI-based coverage targets with critical path identification, layer-specific targets, and explicit "don't test this" guidelines. Use for "test coverage", "coverage strategy", "test priorities", or "coverage targets".

Crack password hashes using hashcat/john, perform password spraying, brute force authentication, and execute pass-the-hash attacks. Use when cracking credentials or performing password-based attacks.

Create a library-grade Vue composable that accepts maybe-reactive inputs (MaybeRef / MaybeRefOrGetter) so callers can pass a plain value, ref, or getter. Normalize inputs with toValue()/toRef() inside reactive effects (watch/watchEffect) to keep behavior predictable and reactive. Use this skill when user asks for creating adaptable or reusable composables.

Create a library-grade Vue composable that accepts maybe-reactive inputs (MaybeRef / MaybeRefOrGetter) so callers can pass a plain value, ref, or getter. Normalize inputs with toValue()/toRef() inside reactive effects (watch/watchEffect) to keep behavior predictable and reactive. Use this skill when user asks for creating adaptable or reusable composables.

Build and wire an `AtomicAgent[InSchema, OutSchema]` — schemas, `AgentConfig`, `SystemPromptGenerator`, provider client, history, hooks, optional context providers. Use when the user asks to "create an agent", "add another agent", "build an `AtomicAgent`", "wire up an agent", "make a planner/router/extractor agent", or runs `/atomic-agents:create-atomic-agent`.

Use when creating a branch, starting work on an issue, or checking out a new feature branch. Validates branch naming and links to GitHub issues automatically.

Use when creating a Jira CAB ticket in the CHANGE (Change Management) project — these tickets use a different field layout from CRD/CO. Triggers on phrases like "create a change ticket", "open a CAB", "deploy X", "Updated X", or any mention of CHANGE-#### tickets that need shaping.

Extract and save current session workflow as a reusable slash command. Use when user says "create command", "save this as command", or wants to automate a workflow.

This skill should be used when the user asks to "create an image", "generate an image", "make an illustration", "design a graphic", "generate a diagram", "make me a picture", "create a visual", "generate artwork", or mentions "banana squad", "nano banana", "image generation team". Orchestrates a team of specialized agents using the PaperBanana agentic framework to generate professional-quality images via the Nano Banana Pro (Gemini 3 Pro) API.

This skill should be used when the user asks to "create an MCP App", "add a UI to an MCP tool", "build an interactive MCP View", "scaffold an MCP App", or needs guidance on MCP Apps SDK patterns, UI-resource registration, MCP App lifecycle, or host integration. Provides comprehensive guidance for building MCP Apps with interactive UIs.

Initialize a new Next.js project with optimal defaults. Use when user says "create next app", "new next project", or "init next".

Create a new custom note type with its own template

Create OpenClaw plugins/extensions (TypeScript modules) from natural‑language requests. Use when the user asks to create a plugin/extension, add a new slash command, add plugin tools, or says “create plugin that does …” or “create OpenClaw plugin called NAME …”. Trigger for /create-plugin NAME WHAT-IT-DOES, /create-plugin GENERAL-PROMPT, “create extension that does ACTION”, or similar.

Scaffold a new Claude Code plugin with proper directory structure, plugin.json, skills, commands, and agents

Create a pull request with Conventional Commits formatting, a templated body, and local verification. Use when the user asks to create a PR, open a PR, submit changes for review, or put code up for review.

Create Pull Requests following best conventions. Use when opening PRs, writing PR descriptions, or preparing changes for review.

Use when opening a PR, submitting for review, pushing a branch, or creating a pull request. Pushes and creates GitHub PRs with auto-assignment and description.

Create a feature-specific PRD (FRD) for individual features

This skill should be used when developing custom rules for coding standards, conventions, or guidelines that Claude should follow. It covers rule structure, types, and best practices.

Extract large inline test modules into adjacent test files while preserving the same effective visibility, helper access, and coverage shape. Use when the user wants implementation files slimmed down without accidentally turning private unit tests into weaker integration tests.

Creates a new git/jj worktree for development work with proper setup, dependencies, and optional thoughts initialization. Use when user needs to create a new worktree for feature development or bug fixes.

Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email or Slack on each tick. Use when the user wants "send me a weekly AI summary of X" rather than a one-off report.

Create a git branch with an appropriate name derived from current changes. Use when the user asks to create a branch, name a branch, make a branch for current work, or wants to move changes to a new branch. Also use when changes exist on main/master that should be moved to a feature branch before committing.

Use when writing cross-referenced sections in a bookwright project. Covers the header comment block template, label-naming conventions, when to use prose-only vs Cref, forward-reference documentation, and the integration-check baseline.

Parse and query changelogs — filter by version, change type, keyword, or show latest entries. Works with target changelogs and individual plugin CHANGELOGs.

Capture a git snapshot of a tracked directory — detects changes, commits current state, updates snapshot log. Use to checkpoint before/after updates.

Cross-Site Request Forgery prevention techniques. Use this skill when implementing forms, state-changing operations, or reviewing CSRF protections. Activate when: CSRF, cross-site request forgery, form security, token validation, same-site cookie, state changing request, POST request security.

Analyzes CSV files and automatically generates comprehensive summaries with statistical insights, data quality checks, and visualizations using Python and pandas. No questions asked — just upload a CSV and get a full analysis immediately.

Load PRD, FRD, Tech Spec, or RFC into context

Cloud memory for AI agents. Store, search, and recall context across sessions.

Use when building a managed team skills library for a real stack. Map work to shelves, browse before curating, write meaningful `whyHere` notes, and create a starter pack once the first pass is solid.

Build a comprehensive customer profile from Intercom data, including conversation history, account context, and interaction timeline. Use when the user asks to "look up a customer", "customer profile", "customer 360", "tell me about this customer", "summarize a customer's history", or provides a customer email or company name and wants a full picture.

When the user wants to create, optimize, or audit customer stories or case study pages. Also use when the user mentions "case studies," "customer stories," "success stories," "testimonials page," "case study," "customer proof," "social proof page," or "results page." For testimonial components, use testimonials-generator.

Orchestrate a 4-agent cyber defense pipeline to analyze log files for threats. Use when investigating security logs, detecting anomalies in access patterns, classifying breach severity, or generating incident reports from nginx/auth/syslog files.

Cloudflare D1 migration workflow: generate with Drizzle, inspect SQL for gotchas, apply to local and remote, fix stuck migrations, handle partial failures. Use when running migrations, fixing migration errors, or setting up D1 schemas.

Bootstrap d3k in standalone AI apps (Codex, Cursor, Claude Code): detect/install dev3000, start d3k as the runtime, and use unified logs plus CDP browser control instead of running npm/bun dev directly.

Automated daily planning and reflection system with morning briefs, wind-down prompts, sleep nudges, and weekly reviews. Use when the user wants to set up a structured daily routine, morning briefings, evening reflection prompts, or weekly planning sessions. Triggers include requests for daily schedules, morning briefs, wind-down routines, sleep reminders, weekly reviews, productivity systems, or daily planning automation.

Write and organize unit tests for functions, methods, and classes using `package:test`. Use when creating new logic or fixing bugs to ensure code remains correct and regression-free.

Write unit tests with mocking and coverage analysis for pure Dart projects and CLI apps. Use when testing business logic, generating mocks with Mockito or mocktail, or measuring test coverage.

Uses static analysis diagnostics and custom handling patterns for null safety, dynamic lists, contravariance overrides, and unrecoverable errors.

Workflow for fixing package version conflicts. Use this when `pub get` fails due to incompatible package versions.

Configure project linter rules, configure `analysis_options.yaml`, enforce strict static type checking, and manage fine-grained file or line-level diagnostic suppressions.

Core concepts and best practices for `package:test`. Covers `test`, `group`, lifecycle methods (`setUp`, `tearDown`), and configuration (`dart_test.yaml`).

Use switch expressions and pattern matching where appropriate

Use when "data pipelines", "ETL", "data warehousing", "data lakes", or asking about "Airflow", "Spark", "dbt", "Snowflake", "BigQuery", "data modeling"

Process and validate data inputs

Generates deterministic seed data for development and testing with factory functions, realistic fixtures, and database reset scripts. Use for "data seeding", "test fixtures", "database seeding", or "mock data generation".

Database schema design, optimization, and migration patterns for PostgreSQL, MySQL, and NoSQL databases. Use for designing schemas, writing migrations, or optimizing queries.

Database schema migration patterns and best practices. Use when creating database migrations, implementing zero-downtime schema changes, version control for databases, or managing data migrations.

Query and filter Datadog logs from the shell using the Composio CLI. Run scoped log searches, pivot across services/environments, and export structured JSON for downstream agents instead of click-driving the Datadog UI.

Build semantic queries with measures, dimensions, filters, and time dimensions for Drizzle Cube.

Audit what the Bits AI assistant (MCP server) has done in your Datadog org — tool calls by user, resources accessed, and anomaly flags for AI governance.

Investigate a potentially compromised Datadog API key — timeline of actions, geo/IP breakdown, endpoints called, anomaly flags, and remediation steps.

Systematic 4-phase debugging methodology for complex, intermittent, or mysterious issues. Use when investigating bugs, race conditions, or unexplained failures.

Diagnose failure modes by systematically investigating traces. Trigger when the user explicitly asks for cross-trace diagnosis: "what's going wrong?", "were there errors?", "debug this", "where is my agent struggling?". Do NOT trigger on: (1) advice questions ("what should I do?"), (2) statistical questions ("what's the average latency?"), (3) summarize requests, (4) trace filtering ("show me traces with errors"), (5) vague questions ("is there a problem?"), (6) unrelated requests.

Record and look up decisions in notes/DECISIONS.md with dcn-xxxx reference codes. Use for logging architectural choices, design decisions, and team agreements, or finding past decisions. Triggers on: "log a decision", "we decided", "record this decision", "decision log", "what did we decide about", "find decision".

Refactoring planning skill - creates prioritized, actionable refactoring plans

Core skill for safe refactoring - enforces test-first approach and atomic changes